hperrin

There are even people who do it for fun.

“Actors would just go crazy if they had to do the exact same thing they’ve been doing for the past three decades.”

I can literally think of the XZ utils off the top of my head. That was nearly the most prolific supply side attack of all time, and it absolutely was in the Debian repos, signed by the Debian package maintainers. In a docker container, that attack wouldn’t have worked. It’s only when installed on bare metal.

Oh yes. Sorry, I worded that poorly. Thank you for clarifying.

I feel like your threat model is not realistic. It is way more likely that you will be running malicious and/or vulnerable code that was packaged appropriately by the actual package maintainer than for a CA compromise to allow an attacker to inject a malicious package during a MITM attack while retrieving an OCI image from a container repository.

Like, yes, you shouldn’t 100% trust your ISP or your DNS server, but if you’re that paranoid, you shouldn’t trust your distro’s repository either. You should be building everything from source.

That’s because package managers are designed to use mirrors. You have to verify a digital signature because the package isn’t necessarily coming from the package maintainer’s repo.

Docker pulls come from the registry, not a mirror. There is no such thing as a mirror in docker. The registry is something you decide on, and if you don’t trust it, you shouldn’t use it. If the registry itself is compromised, that’s essentially like the private key of a package manager getting compromised. Same risk.

The two biggest registries are Docker Hub and GitHub. If either of them were compromised, it wouldn’t take very long for them to mitigate it. The damage would likely be very small.

Absolutely love the part where he said they don’t use AI and then that they do use AI.

Why do you say that? Docker Hub is, of course, susceptible to supply chain attacks, as are the official containers of each of these projects, but how is that all that different from installing these projects on bare metal? And how are any of them “extremely” vulnerable?

I didn’t suggest anything that isn’t either an official build from the project maintainers, or a very well supported community build from a reputable source.

Every once in a while, you should run these commands in each services folder:

docker compose pull
docker compose up -d

# check if everything is still good

docker system prune -a

You should also back up your services folder regularly. That’s beyond the scope of this Lemmy comment, though.

In NPM, set up an access list like this:

Image

Last one should be your public IP address, with “/32” on the end.

Use this access list for all services you don’t want the wider internet to see (probably all of them for you). With this setup, you can still open a service, if you want, but normally you’ll need to be on your VPN to see it from outside your house.

From now on, whenever you set up a service, you’ll use a subdomain, and you’ll point it in dns as a CNAME record at your apex domain (usually just an @ symbol in the input box). You’ll then (if it’s a web service) create a proxy in NPM pointed at whatever port you give it.

So now you wanna create a WireGuard vpn, so you can securely access your own stuff from your own devices outside your house. (I’d recommend not opening every service up to the internet.)

github.com/linuxserver/docker-wireguard

That one can be tricky, but ultimately you should have a file (or QR code) that you can put on your phone in the WireGuard app that will give you vpn access. Remember to set up a CNAME for your subdomain (something like vpn.example.com). Although, for this, it would be fine to use the apex domain.

So now you can set up a Nextcloud and an Immich stack. Put them on an unused port, then point a proxy for their subdomain at that port (127.0.0.1:2201 or whatever), add your SSL cert, and you’re good.

[continued…]

It sounds like you just wants Nextcloud and maybe Immich. So here’s my suggestion:

If you don’t have a domain yet, buy a domain. Preferably through Cloudflare because their API is good, and you’ll need that. Point an apex A record at your public IP address.

Set up something like Kubuntu on the box itself. Make sure it has a static IP address (you can also do DHCP reserved through your router, which is safer), and forward ports 80 (TCP), 443 (TCP), and 51820 (UDP) to that box.

Now comes the magic. Install docker through the official installation docs for Ubuntu (don’t use Ubuntu’s packages). Create a folder in your home directory called “services”. Inside this folder, you’re going to set up a folder for each service you need. The first one you should set up is “nginx-proxy-manager”. Inside each folder you’ll have a “docker-compose.yml” file. Inside that file, set up your docker compose stack. Nginx Proxy Manager’s is pretty simple. Just one service. But change the network mode to “host”, and remove the ports section.

nginxproxymanager.com/setup/

Now, from a terminal, in that folder, run docker compose up -d. Get used to that command, you’ll run it a lot. Then go to localhost:81, and create an account for NPM. Use a real email address, because that’ll be your contact email for Let’s Encrypy ssl. Go into the ssl settings and create a certificate. You’ll need an api key from Cloudflare, or whatever other place you bought your domain from. It needs access to change the dns settings for your domain. Use this format to create your certificate:

example.com, *.example.com

And use the dns challenge option where you’ll put your api key.

[continuing in next post]

I had the same issue a while ago. :) I think the docs tell you to do it the way you had it, which is why it causes confusion.

Just mount /dev/dri.

Done! :)

If there’s only one file that’s AI generated, what should I tag it? Partially AI?

This is not possible. The other servers need to be able to communicate with yours, and for that, yours needs a domain name.

If you only care about local users following other local users, and only other local users, then this is possible. But if you add remote users into the mix, you need to federate, and to federate requires a domain name.

Damn man. You were cool. What happened that now you’re one of us here on Lemmy?

Not enough hard drive clicking noise either.

I was afraid when I saw this

Image

that it was just slopware, but it seems like it only has a few commits by Claude. And the commits aren’t just a firehose, like slopware tends to be.

I use Nextcloud Deck. It’s amazing.

For eink, the XTEink devices work offline. If you put crosspointreader.com on them, then it’s not even XTEink’s software running on it.

That’s crazy. I had a really similar idea a while ago. Mine was trying to go buy some milk but you can’t stop shooting lasers everywhere you look. Glad somebody made it. :)

How much of this is written by AI?

I use Port87, so I’ll just block that address and give Valve a new one. If your email doesn’t have a feature like this, you need a new email.

As much as I would like 1981 to only be two decades ago, I’m afraid it was four and a half decades ago.

A decade? Email has been around longer than the web. Roughly forty years.

If you have your own domain, you won’t ever have to migrate addresses, just possibly providers.

This really saddens me. Email is such a fundamentally good and open protocol. The only reason people don’t like it is because of big tech’s shenanigans.

I run an email service called Port87. I invite you to try it and see if it can convince you that email is actually a great technology, when detached from big tech slop. It’s got some really killer features that make it great for organization and preventing spam. You can also tell it that on certain addresses, it should completely ignore the strict auth requirements it usually has, so it will accept email from your own services without you having to set up all the extra bullshit that’s meant for stuff that matters more.